Repository navigation
[SCF-2415] [Part 2] Remove release-it and release-it-lerna-changelog - #7
Merged
Gaurav0 merged 39 commits intoNov 5, 2026
Conversation
This was referenced Oct 28, 2026
Merged
Merged
Releases in this fork are hand-made "bump version" commits; release-it was never run. Dropping it (and its changelog config, script and RELEASE.md instructions) removes vm2, ip, ip-address, tar 6, parse-url, parse-path, http-cache-semantics 4, form-data 4.0.0 and semver 7.3.5 from the tree. Three of those have advisories with no fixed release. Also deletes config/release.js, the leftover ember-cli-release config (that addon was removed in b25a1b4 and the gulp tasks it calls no longer exist). Audit: critical 50 -> 15, high 114 -> 85. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The YUIDoc and gulp tooling only builds the docs site, but as root devDependencies it put yuidocjs's request 2.40 tree (hawk, hoek, form-data 0.1, qs 1, mime 1.2), markdown-it 4, gulp's chokidar 2 and gulp-util's lodash.template 3 into the addon's lockfile. Upstream ember-bootstrap keeps this tooling in its docs workspace too. - gulpfile.js and yuidoc.json move to docs/; root docs:build and docs:serve delegate to docs/. - gulp, gulp-connect, gulp-transform, merge-stream, striptags and execa move to docs/package.json; the unused gulp-insert and gulp-rename are dropped. - docs:api runs the yuidoc CLI (yuidocjs) from the addon root instead of `ember ember-cli-yuidoc`, so source paths and the version badge (git-repo-version of the addon) stay as before. ember-cli-yuidoc attributed bs-carousel.js's 45 members to Components.Collapse and omitted Components.Carousel; the CLI output gets both right. docs:app (the ember-cli 3.26 docs app build) already failed before this change: the app is on ember-auto-import 1, which ember-bootstrap no longer supports. Audit: critical 15 -> 14, high 85 -> 72. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-qunit 5 and ember-a11y-testing 4 each pulled in ember-auto-import 1 and with it webpack 4, babel-core 6 and node-libs-browser. Those carried babel-traverse 6 (critical, no fixed release), sha.js (critical), elliptic, json5 0.5, serialize-javascript 4 and braces 2. Scoped resolutions move both onto ember-auto-import 2, which the app already uses; ember-qunit 6's breaking change was exactly this move. Deduplicated to a single 2.13.1, the copy ember-auto-import v2 already elected as leader (the root dependency stays within ^2). Same 536 tests run (526 pass, 10 skipped), including all accessibility checks. Audit: critical 14 -> 6, high 72 -> 64. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-try 1.4's ember-try-config pulled ember-source-channel-url 1.x, which uses got 8 -> cacheable-request 2 -> http-cache-semantics 3.8.1 (high; one advisory has no fixed release). Version 3 keeps the same getChannelURL(channel) export, uses node-fetch instead of got, supports Node 18, and was already in the tree for config/ember-try.js. The key needs the **/ prefix because ember-try-config is not a direct dependency. Verified with `ember try:one ember-lts-4.8` (BOOTSTRAPVERSION=4): 536 tests, 526 pass, 10 skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@babel/plugin-transform-modules-systemjs 7.27.1 -> 7.29.8 (forced via resolutions). Pulled in through @babel/preset-env. Fixes CVE-2026-44728 (COMP-10029). 7.29.x needs 7.29 helpers and traverse, so the rest of Babel moves too instead of running a nested 7.29 tree next to 7.27: every @babel/* entry was re-resolved to the newest release in its range and collapsed with yarn-deduplicate (@babel/core and @babel/preset-env 7.27 -> 7.29.7). Entries that dependents pin exactly or with ~ ranges (code-frame 7.12.11, runtime 7.12.18, plugin-transform-typescript ~7.4/~7.5) stay put. Babel's own deps (core-js-compat, babel-plugin-polyfill-*, regexpu-core, ...) are refreshed with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
browserslist 4.25.0 -> 4.29.5 (forced via resolutions). The Babel 7.29 upgrade already brought in 4.29.5 for @babel/helper-compilation-targets; this merges the 4.25.0 copy still used by webpack and drops its old caniuse-lite, electron-to-chromium, node-releases and update-browserslist-db entries. Fixes CVE-2026-73088 and CVE-2026-73089 (COMP-10048, COMP-10050). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merges the 0.0.28, 0.0.33, 0.1.0 and 0.2.3 copies into 0.2.7, which fixes CVE-2025-54798, CVE-2026-44705 and CVE-2026-49982. All dependents are dev/build tooling and only use APIs still present in 0.2.x. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The tmp resolution is "^0.2.7", but the lockfile recorded it as "tmp@0.2.7". Running yarn install rewrites the key; no resolved version changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brace-expansion 1.1.12 -> 1.1.21 (forced via resolutions). Pulled in through minimatch 3.x. Fixes CVE-2026-13149, CVE-2026-14257, CVE-2026-33750 and CVE-2026-69152 (COMP-10025..10028), plus CVE-2026-102276, CVE-2026-102277 and CVE-2026-102278. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
minimatch 3.1.2 -> 3.1.5 and mocha's exact 3.0.4 pin -> 3.1.5 (forced via resolutions). Fixes CVE-2026-26996, CVE-2026-27903 and CVE-2026-27904 (COMP-10014..10016), plus CVE-2022-3517 on 3.0.4. The floor stays on 3.x: the lockfile also resolves "minimatch@*", which would otherwise jump to a major that needs Node >= 20. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
picomatch 2.3.1 -> 2.3.2 (forced via resolutions). Pulled in through micromatch, anymatch and readdirp. Fixes CVE-2026-33671 and CVE-2026-33672 (COMP-10009, COMP-10010). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The last braces 2.3.2 copies (high) came from micromatch 3 under
ember-cli's sane watcher and its anymatch. micromatch 3 only calls
braces(pattern, options) and uses the returned array, which braces 3
still provides.
Comparing micromatch 3 before and after over brace-heavy globs: every
positive pattern (lists, ranges, nested, extensions) matches the same
files. Negated brace globs such as `!{a,b}/**` now compile to an extglob
and match differently, but sane only ever receives brace-free patterns
here (its default `**/*` and broccoli's `<outputPath>/**` ignore), and
micromatch skips braces entirely for those. `ember serve` still detects
a touched component and rebuilds.
Audit: high 56 -> 52.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fast-uri 3.0.6 -> 3.1.9 (forced via resolutions). Pulled in through ajv 8 (schema-utils, eslint's table). Fixes CVE-2026-6321, CVE-2026-6322, CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75975 and CVE-2026-76172 (COMP-10038..10042, COMP-10047, COMP-10051), plus CVE-2026-84292, CVE-2026-86472, CVE-2026-110095, CVE-2026-110306 and CVE-2026-110725. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mocha 8 pins nanoid 3.1.20 exactly; forcing it via resolutions merges it with postcss's 3.3.20. Fixes CVE-2026-67213, CVE-2026-67214 and CVE-2026-73086 (COMP-10021, COMP-10022, COMP-10046), plus CVE-2021-23566 and CVE-2024-55565 on 3.1.20. Dev-only: postcss's copy, the one that ships through runtime dependencies, was already patched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-cli 3.28 (12.3.2) and its markdown-it-terminal (8.4.2) pulled two old markdown-it copies, each with high advisories, plus linkify-it 2 and 3. markdown-it 14 still ships a CommonJS build and keeps the md().use(plugin).render() API that ember-cli's MarkdownColor relies on; linkify-it 5 comes with it. `ember help generate` and a MarkdownColor render of headings, emphasis, code, links, lists, fences and ember-cli's color tokens produce byte-identical output before and after. Audit: high 62 -> 56. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-cli 3.28 depends on lodash.template ^4.5.0 for blueprint rendering and its initial-commit message; 4.5.0 has high advisories. 4.18.1 is in the same major and clears all of them. All 49 files of ember-cli's app and addon blueprints render identically through ember-cli's processTemplate before and after. Audit: high 52 -> 50. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ansi-html 0.0.7 (high) is pinned by broccoli's ^0.0.7 range, which on a 0.0.x version allows no other release, so it needs a resolution. 0.0.9 renders broccoli's ANSI-colored build-error page identically. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
express 4.21.2 pinned body-parser 1.20.3 and path-to-regexp 0.1.12 exactly (both high). express 4.22.3, within ember-cli's and testem's ^4 ranges, takes body-parser ~1.20.5 and path-to-regexp ~0.1.13; the caret body-parser ranges from ember-a11y-testing and @scalvert/ember-setup-middleware-reporter are refreshed onto the same 1.20.9. Lockfile refresh only. testem serves the test run through express. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
compression 1.8.0 (high) -> 1.8.2, within ember-cli's and testem's ^1.7.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
engine.io 6.6.4 (high) -> 6.6.11, within socket.io's ~6.6.0 range. It brings its own ws ~8.21.0 (8.21.3). testem talks to the browser over socket.io. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
socket.io-parser 4.2.4 (high) -> 4.2.7, within socket.io's ~4.2.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ws 8.17.1 and 8.18.2 (both high) remained after the engine.io refresh: - jsdom's ^8.2.3 range refreshes to 8.22.0. - socket.io-adapter 2.5.5 pinned ws ~8.17.1; socket.io-adapter 2.5.8, within socket.io's ~2.5.2 range, takes ~8.21.0 (8.21.3), the same copy engine.io already uses. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
websocket-driver 0.7.4 (critical) -> 0.7.5, within faye-websocket's >=0.5.1 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
proxy-addr 2.0.7 (critical) -> 2.0.8, within express's ~2.0.7 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
webpack 5's terser-webpack-plugin 5.3.14 depended on serialize-javascript 6.0.2 (high; the fix, 7.x, needs Node >= 20). 5.6.1, still inside webpack's ^5.3.11 range, no longer depends on serialize-javascript at all. Lockfile refresh only. The production build bundles the same modules and identifiers; only webpack's numeric module ids in the two ember-auto-import chunks (and so their content hashes and the references in index.html) change. Audit: high 50 -> 49. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shell-quote 1.8.3 (critical, high) -> 1.12.0, within npm-run-all's ^1.6.1 range. npm-run-all drives `yarn lint`, which still runs all its tasks. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
form-data 4.0.3 (critical, high) -> 4.0.6, within jsdom's ^4.0.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@xmldom/xmldom 0.8.10 (13 high findings) -> 0.8.15, within testem's ^0.8.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
flatted 3.3.3 (high) -> 3.4.4, within flat-cache's ^3.2.9 range (eslint's cache, exercised by `yarn lint`). Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
js-yaml 3.14.1 (ember-cli, testem, tap-parser) and 4.0.0 (mocha) both have high advisories. - The ^3 ranges refresh to 3.15.2 (lockfile only). - mocha 8 pins js-yaml 4.0.0 exactly, so a resolution scoped to mocha moves it to 4.3.2 (same major). mocha uses it to read YAML config; loading a .mocharc.yml through it still runs all node tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
source-map-js 1.2.1 (high) -> 1.2.2, within css-tree's ^1.0.1 range (eslint-plugin-ember). It merges with the 1.2.2 copy already in the tree. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
underscore 1.13.7 (high) -> 1.13.8, within backbone's >=1.8.3 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gaurav0
force-pushed
the
gaurav/chore/SCF-2415-part-2-remove-release-it
branch
from
October 28, 2026 23:53
13d5652 to
6a3b9ee
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With push on every branch and pull_request on every base branch, each push to a branch with an open PR ran the full matrix twice. PRs are still covered by the pull_request trigger, which uses '**' so stacked PRs on gaurav/chore/... bases run (b057803). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…he type attribute Since f005cd0 the default submit button set its type with @buttonType="submit", which only BsButton understands. A custom @buttonComponent that renders <button type="button" ...attributes> ignored it, so its clicks never submitted the footer form and @onsubmit never ran. Before f005cd0, onClick={{@onsubmit}} reached any button component through ...attributes. Pass type="submit" as an HTML attribute instead. BsButton applies ...attributes after its own type, so it still renders a submit button, and @buttonType is deprecated anyway. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…andles it 6c23b4c made the footer <form> always call preventDefault() on submit, to stop the page reload when its submit button calls @onsubmit. That also blocked native submission where it used to happen: a standalone footer without @onsubmit, and a footer given an action attribute (e.g. <modal.footer action="/export" method="post">). Only prevent the default when @onsubmit is given and the form has no action attribute. That still covers the reload in BsModal, where the footer always gets onSubmit and no action. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8945d07 (upstream ember-bootstrap#2027) replaced `@arg visible = true` with `this._visible ?? true`, so @visible={{null}} (e.g. an unset model attribute) now shows the alert. @arg only falls back to its default for undefined, so null used to hide it. Fall back for undefined only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8945d07 copied @visible into the tracked _visible from a {{did-update this.updateVisibility @visible}} modifier. Writing it during modifier commit schedules a second render, and only that render runs {{did-update this.showOrHide this._visible}}, so each @visible change took an extra render pass before the fade started. Resolve visibility in the visible getter instead. A dismissal records how often @visible had changed at the time (_dismissedAt), and holds until @visible changes again, which the getter counts in untracked fields. That keeps ember-bootstrap#2027's behavior (dismiss doesn't touch @visible, and setting @visible to false and back to true shows the alert again) without writing tracked state while rendering, which is what broke @localcopy on Ember canary. showOrHide's did-update now reads @visible itself, so without a fade onDismissed is called from the afterRender queue instead of from the modifier: a handler that sets @visible (as in ember-bootstrap#2027's test) would otherwise update a value that render has already used. With a fade it was already called later, from a timer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ly under Embroider 7b53aa7 skipped it everywhere for an Embroider-only failure (ember-bootstrap#1682), so classic builds stopped checking that BsForm doesn't swallow errors thrown by @onsubmit. Skip it only when @embroider/core is installed, the check @embroider/test-setup's maybeEmbroider uses to build with Embroider. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Joeu
approved these changes
Nov 4, 2026
Gaurav0
merged commit Nov 5, 2026
ee88a0f
into
gaurav/chore/SCF-2415-part-1-drop-node-16
152 of 157 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the
release-itandrelease-it-lerna-changelogtooling, along withconfig/release.js, the matchingRELEASE.mdinstructions, thechangelogscript and therelease-it/changelogblocks inpackage.json. This drops a large dependency subtree, so the later security bumps in this stack touch fewer packages.About 1.6k lines of
yarn.lockare removed.Needs a decision: this is a tooling change, not just a version bump. After this lands, releases must be cut without release-it.
Dependencies
release-it^14.6.2)release-it-lerna-changelog^3.1.0)lerna-changelogStack
Part of the SCF-2415 audit work, split from
gaurav/chore/SCF-2415-audit-critical-highfor easier review. This is part 2 of 10. Stacked on Part 1: its base isgaurav/chore/SCF-2415-part-1-drop-node-16, so the diff only shows this part. Merge in order.@visibleregressionsReview notes
Confirm that removing release-it is acceptable for how this fork is released. The lockfile change is a pure prune.
Testing
yarn install --frozen-lockfilepasses on this branch. The full suite (yarn lint,ember test) was run on Part 9 (0 lint errors, 526 passed, 10 skipped, 0 failed) and again on Part 10 (0 lint errors, 532 passed, 9 skipped, 0 failed). Part 10 adds 5 tests and un-skips 1.🤖 Generated with Claude Code